Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Site-to-site VPN, can only connect one direction to appliance

    Scheduled Pinned Locked Moved OpenVPN
    14 Posts 3 Posters 1.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • RicoR
      Rico LAYER 8 Rebel Alliance
      last edited by

      Please share your OpenVPN Configuration, Firewall Rules and LAN Interface Configuration via Screenshots.
      ATM we know nothing about your setup, not even which OpenVPN server mode you are running.

      -Rico

      L 1 Reply Last reply Reply Quote 1
      • L
        LamboJ @Rico
        last edited by

        @rico said in Site-to-site VPN, can only connect one direction to appliance:

        Please share your OpenVPN Configuration, Firewall Rules and LAN Interface Configuration via Screenshots.
        ATM we know nothing about your setup, not even which OpenVPN server mode you are running.

        -Rico

        Hi,
        Please find screenshots here: https://imgur.com/a/Wgumzm3

        Let me know if there's any other info, I can provide.

        Thanks

        1 Reply Last reply Reply Quote 0
        • RicoR
          Rico LAYER 8 Rebel Alliance
          last edited by Rico

          192.168.96.0/19 overlaps your tunnel network 192.168.121.0/24
          Why do you use /19 as Remote Networks and not your 192.168.33.0/24 and 192.168.97.0/24 to be more specific?
          BTW, you can upload pictures directly into the forum.

          -Rico

          L 1 Reply Last reply Reply Quote 0
          • L
            LamboJ @Rico
            last edited by

            @rico said in Site-to-site VPN, can only connect one direction to appliance:

            192.168.96.0/19 overlaps your tunnel network 192.168.121.0/24
            Why do you use /19 as Remote Networks and not your 192.168.33.0/24 and 192.168.97.0/24 to be more specific?
            BTW, you can upload pictures directly into the forum.

            -Rico

            Shouldn't the tunnel be part of the of the network to be routed? i.e. part of site B, given site B is acting as the server?

            I've used /19 so I can add more VLANs to each site without having to reconfigure anything.

            1 Reply Last reply Reply Quote 0
            • RicoR
              Rico LAYER 8 Rebel Alliance
              last edited by

              No, the tunnel network is used internally by OpenVPN between tunnel endpoints.
              Pick a network that it is not in use locally or at any remote site.

              -Rico

              L 1 Reply Last reply Reply Quote 1
              • PippinP
                Pippin
                last edited by

                Informational:
                https://community.openvpn.net/openvpn/wiki/AvoidRoutingConflicts

                I gloomily came to the ironic conclusion that if you take a highly intelligent person and give them the best possible, elite education, then you will most likely wind up with an academic who is completely impervious to reality.
                Halton Arp

                1 Reply Last reply Reply Quote 1
                • L
                  LamboJ @Rico
                  last edited by

                  @rico said in Site-to-site VPN, can only connect one direction to appliance:

                  No, the tunnel network is used internally by OpenVPN between tunnel endpoints.
                  Pick a network that it is not in use locally or at any remote site.

                  -Rico

                  I've changed the tunnel network to: 192.168.224.0/30 (on both appliances), but still seeing the same issue.

                  1 Reply Last reply Reply Quote 0
                  • RicoR
                    Rico LAYER 8 Rebel Alliance
                    last edited by

                    Did you try to be more specific with the Remote networks?
                    For the box with pfSense LAN IP 192.168.33.1/24 set the OpenVPN Remote network to 192.168.97.0/24
                    For the box with pfSense LAN IP 192.168.97.1/24 set the OpenVPN Remote network to 192.168.33.0/24

                    -Rico

                    L 1 Reply Last reply Reply Quote 0
                    • L
                      LamboJ @Rico
                      last edited by

                      @rico said in Site-to-site VPN, can only connect one direction to appliance:

                      Did you try to be more specific with the Remote networks?
                      For the box with pfSense LAN IP 192.168.33.1/24 set the OpenVPN Remote network to 192.168.97.0/24
                      For the box with pfSense LAN IP 192.168.97.1/24 set the OpenVPN Remote network to 192.168.33.0/24

                      -Rico

                      Just tried that as well, unfortunately no luck.

                      1 Reply Last reply Reply Quote 0
                      • RicoR
                        Rico LAYER 8 Rebel Alliance
                        last edited by Rico

                        Could there be something else overlapping, like an IPsec tunnel?
                        What exactly is not working? You can't ping 192.168.97.1 from that 192.168.33.1 pfSense Box?

                        -Rico

                        L 1 Reply Last reply Reply Quote 0
                        • L
                          LamboJ @Rico
                          last edited by LamboJ

                          @rico said in Site-to-site VPN, can only connect one direction to appliance:

                          Could there be something else overlapping, like an IPsec tunnel?
                          What exactly is not working? You can't ping 192.168.97.1 from that 192.168.33.1 pfSense Box?

                          -Rico

                          Correct, the issue is that I can't ping 192.168.97.1 from anywhere in Site A. So I can' t ping 192.168.97.1 from 192.168.33.1 or from any other hosts like 192.168.33.2, etc.

                          Site A doesn't have any ipsec tunnels. Site B (192.168.97.0/24) has an IPSec tunnel to Site C which is an Azure gateway (not pfsense). Here's the configuration:
                          5abc9d76-a0ab-4445-a0ff-d683c35cba33-image.png

                          1 Reply Last reply Reply Quote 0
                          • RicoR
                            Rico LAYER 8 Rebel Alliance
                            last edited by

                            Your IPSec Local Network overlaps 192.168.97.0/24 and 192.168.33.0/24
                            I'm not really into IPsec, but pretty sure it could grab that OpenVPN traffic.
                            TBH, I lose track a bit about your whole setup, it is not easy to follow which site is which Configuration, Rules or even local/remote networks.
                            It could help to sketch up your network layout.

                            -Rico

                            L 1 Reply Last reply Reply Quote 0
                            • L
                              LamboJ @Rico
                              last edited by

                              @rico said in Site-to-site VPN, can only connect one direction to appliance:

                              Your IPSec Local Network overlaps 192.168.97.0/24 and 192.168.33.0/24
                              I'm not really into IPsec, but pretty sure it could grab that OpenVPN traffic.
                              TBH, I lose track a bit about your whole setup, it is not easy to follow which site is which Configuration, Rules or even local/remote networks.
                              It could help to sketch up your network layout.

                              -Rico

                              Thanks for all your help, but it actually looks like everything was correct in terms of settings, I just needed to reboot the appliance and it worked. I didn't realize rebooting would help here

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.